Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
16/05/2023, 01:30
Static task
static1
Behavioral task
behavioral1
Sample
fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe
Resource
win10v2004-20230220-en
General
-
Target
fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe
-
Size
1.1MB
-
MD5
88c1ee32fb16e295b2e845bd8dd51b93
-
SHA1
6be47a42849f15f565da66dfa097f6b5265f5075
-
SHA256
fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680
-
SHA512
577ba596c746d173c7a6718e3af8c9c166a28813cbbb73abecc370bb54ff73edfe99c25f432182b037df90c393eade4577c3f8a86c8b15e2a26bb5677fcf443e
-
SSDEEP
24576:+yABLYhtlEtECOl426WoU44ZkiyW0RHWNBc2DX3MI:NAurlEtEe8xy2o
Malware Config
Extracted
redline
mufta
185.161.248.75:4132
-
auth_value
171bdaad6dbf652c48d4e9334c756dfa
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a1336087.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a1336087.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a1336087.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a1336087.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a1336087.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a1336087.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 1992 v7419505.exe 1016 v5816283.exe 596 a1336087.exe 1100 b3272144.exe -
Loads dropped DLL 13 IoCs
pid Process 2000 fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe 1992 v7419505.exe 1992 v7419505.exe 1016 v5816283.exe 1016 v5816283.exe 596 a1336087.exe 1016 v5816283.exe 1100 b3272144.exe 1032 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features a1336087.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a1336087.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v5816283.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v7419505.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v7419505.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5816283.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1032 1100 WerFault.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 596 a1336087.exe 596 a1336087.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 596 a1336087.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1992 2000 fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe 27 PID 2000 wrote to memory of 1992 2000 fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe 27 PID 2000 wrote to memory of 1992 2000 fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe 27 PID 2000 wrote to memory of 1992 2000 fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe 27 PID 2000 wrote to memory of 1992 2000 fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe 27 PID 2000 wrote to memory of 1992 2000 fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe 27 PID 2000 wrote to memory of 1992 2000 fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe 27 PID 1992 wrote to memory of 1016 1992 v7419505.exe 28 PID 1992 wrote to memory of 1016 1992 v7419505.exe 28 PID 1992 wrote to memory of 1016 1992 v7419505.exe 28 PID 1992 wrote to memory of 1016 1992 v7419505.exe 28 PID 1992 wrote to memory of 1016 1992 v7419505.exe 28 PID 1992 wrote to memory of 1016 1992 v7419505.exe 28 PID 1992 wrote to memory of 1016 1992 v7419505.exe 28 PID 1016 wrote to memory of 596 1016 v5816283.exe 29 PID 1016 wrote to memory of 596 1016 v5816283.exe 29 PID 1016 wrote to memory of 596 1016 v5816283.exe 29 PID 1016 wrote to memory of 596 1016 v5816283.exe 29 PID 1016 wrote to memory of 596 1016 v5816283.exe 29 PID 1016 wrote to memory of 596 1016 v5816283.exe 29 PID 1016 wrote to memory of 596 1016 v5816283.exe 29 PID 1016 wrote to memory of 1100 1016 v5816283.exe 30 PID 1016 wrote to memory of 1100 1016 v5816283.exe 30 PID 1016 wrote to memory of 1100 1016 v5816283.exe 30 PID 1016 wrote to memory of 1100 1016 v5816283.exe 30 PID 1016 wrote to memory of 1100 1016 v5816283.exe 30 PID 1016 wrote to memory of 1100 1016 v5816283.exe 30 PID 1016 wrote to memory of 1100 1016 v5816283.exe 30 PID 1100 wrote to memory of 1032 1100 b3272144.exe 31 PID 1100 wrote to memory of 1032 1100 b3272144.exe 31 PID 1100 wrote to memory of 1032 1100 b3272144.exe 31 PID 1100 wrote to memory of 1032 1100 b3272144.exe 31 PID 1100 wrote to memory of 1032 1100 b3272144.exe 31 PID 1100 wrote to memory of 1032 1100 b3272144.exe 31 PID 1100 wrote to memory of 1032 1100 b3272144.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe"C:\Users\Admin\AppData\Local\Temp\fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7419505.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7419505.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5816283.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5816283.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1336087.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a1336087.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:596
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3272144.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3272144.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 6405⤵
- Loads dropped DLL
- Program crash
PID:1032
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
749KB
MD5f4dbfddb199e8debc33d41981f15c7ac
SHA105dc4ba214f6127afcfa06203a10425c254b09a2
SHA256531fdd5d697eae030b3c77519c6036e5c2929750e2983a8df4039281d89ecfa1
SHA51251d00d60bf444a5a0be8531054b060340fe0fff91122956948a8927bd2265a8a910b8a08b8df21de6825c587c5faaae7b2e97e67004fbca610d983cff33d0e99
-
Filesize
749KB
MD5f4dbfddb199e8debc33d41981f15c7ac
SHA105dc4ba214f6127afcfa06203a10425c254b09a2
SHA256531fdd5d697eae030b3c77519c6036e5c2929750e2983a8df4039281d89ecfa1
SHA51251d00d60bf444a5a0be8531054b060340fe0fff91122956948a8927bd2265a8a910b8a08b8df21de6825c587c5faaae7b2e97e67004fbca610d983cff33d0e99
-
Filesize
305KB
MD50fd93596d6063b8722d5473408950773
SHA14ac58161c965a130dd36d167e27f8d255fae0bcb
SHA2569faa8fb0f555cf1e262457db70ef8af73f1a8ab3e4afcf24f1459a81f55c7d99
SHA512f408604263dfcfb75e6d61a151312ba09a7cc4b81554b39320a67a84a16326081d266cbb4387d738439631d627f07cf1e7155835d8f4f5a8361947a88664f54b
-
Filesize
305KB
MD50fd93596d6063b8722d5473408950773
SHA14ac58161c965a130dd36d167e27f8d255fae0bcb
SHA2569faa8fb0f555cf1e262457db70ef8af73f1a8ab3e4afcf24f1459a81f55c7d99
SHA512f408604263dfcfb75e6d61a151312ba09a7cc4b81554b39320a67a84a16326081d266cbb4387d738439631d627f07cf1e7155835d8f4f5a8361947a88664f54b
-
Filesize
183KB
MD5d18dd7e957d8eab39abe21eefd498331
SHA12d7b11252dbb1ed8cefff8d63d447b0f697a0060
SHA25657f8f54609021997865fed724894ad76b78b39a48a51b47a1d97a92eb836c440
SHA512c383080be8f9fbb5fd313204cc47ca9ecca8b6148362aa5ef76c219217971184472d0c4be2f1d7e9c9fbee561079b34357346507ddb882d779b06741a5ad0581
-
Filesize
183KB
MD5d18dd7e957d8eab39abe21eefd498331
SHA12d7b11252dbb1ed8cefff8d63d447b0f697a0060
SHA25657f8f54609021997865fed724894ad76b78b39a48a51b47a1d97a92eb836c440
SHA512c383080be8f9fbb5fd313204cc47ca9ecca8b6148362aa5ef76c219217971184472d0c4be2f1d7e9c9fbee561079b34357346507ddb882d779b06741a5ad0581
-
Filesize
145KB
MD5f3dbda8ce2ce5ab20bb537ed402bc7ad
SHA15d3d2cd0adc00fc0b8327f8734bd7aab10dfbb4d
SHA25683ec5ff710d45511afcb097a143b38098e2b7d12374855eaa7b107cf34f21905
SHA512ad5b68bda307f61d7b035962dddacb01b11281b3fa1202929db88fe514ac4cfb9e0f1bc7cb753356c6e6cb2e73cf051908d4043786728cb10493bbd6815a5c41
-
Filesize
145KB
MD5f3dbda8ce2ce5ab20bb537ed402bc7ad
SHA15d3d2cd0adc00fc0b8327f8734bd7aab10dfbb4d
SHA25683ec5ff710d45511afcb097a143b38098e2b7d12374855eaa7b107cf34f21905
SHA512ad5b68bda307f61d7b035962dddacb01b11281b3fa1202929db88fe514ac4cfb9e0f1bc7cb753356c6e6cb2e73cf051908d4043786728cb10493bbd6815a5c41
-
Filesize
749KB
MD5f4dbfddb199e8debc33d41981f15c7ac
SHA105dc4ba214f6127afcfa06203a10425c254b09a2
SHA256531fdd5d697eae030b3c77519c6036e5c2929750e2983a8df4039281d89ecfa1
SHA51251d00d60bf444a5a0be8531054b060340fe0fff91122956948a8927bd2265a8a910b8a08b8df21de6825c587c5faaae7b2e97e67004fbca610d983cff33d0e99
-
Filesize
749KB
MD5f4dbfddb199e8debc33d41981f15c7ac
SHA105dc4ba214f6127afcfa06203a10425c254b09a2
SHA256531fdd5d697eae030b3c77519c6036e5c2929750e2983a8df4039281d89ecfa1
SHA51251d00d60bf444a5a0be8531054b060340fe0fff91122956948a8927bd2265a8a910b8a08b8df21de6825c587c5faaae7b2e97e67004fbca610d983cff33d0e99
-
Filesize
305KB
MD50fd93596d6063b8722d5473408950773
SHA14ac58161c965a130dd36d167e27f8d255fae0bcb
SHA2569faa8fb0f555cf1e262457db70ef8af73f1a8ab3e4afcf24f1459a81f55c7d99
SHA512f408604263dfcfb75e6d61a151312ba09a7cc4b81554b39320a67a84a16326081d266cbb4387d738439631d627f07cf1e7155835d8f4f5a8361947a88664f54b
-
Filesize
305KB
MD50fd93596d6063b8722d5473408950773
SHA14ac58161c965a130dd36d167e27f8d255fae0bcb
SHA2569faa8fb0f555cf1e262457db70ef8af73f1a8ab3e4afcf24f1459a81f55c7d99
SHA512f408604263dfcfb75e6d61a151312ba09a7cc4b81554b39320a67a84a16326081d266cbb4387d738439631d627f07cf1e7155835d8f4f5a8361947a88664f54b
-
Filesize
183KB
MD5d18dd7e957d8eab39abe21eefd498331
SHA12d7b11252dbb1ed8cefff8d63d447b0f697a0060
SHA25657f8f54609021997865fed724894ad76b78b39a48a51b47a1d97a92eb836c440
SHA512c383080be8f9fbb5fd313204cc47ca9ecca8b6148362aa5ef76c219217971184472d0c4be2f1d7e9c9fbee561079b34357346507ddb882d779b06741a5ad0581
-
Filesize
183KB
MD5d18dd7e957d8eab39abe21eefd498331
SHA12d7b11252dbb1ed8cefff8d63d447b0f697a0060
SHA25657f8f54609021997865fed724894ad76b78b39a48a51b47a1d97a92eb836c440
SHA512c383080be8f9fbb5fd313204cc47ca9ecca8b6148362aa5ef76c219217971184472d0c4be2f1d7e9c9fbee561079b34357346507ddb882d779b06741a5ad0581
-
Filesize
145KB
MD5f3dbda8ce2ce5ab20bb537ed402bc7ad
SHA15d3d2cd0adc00fc0b8327f8734bd7aab10dfbb4d
SHA25683ec5ff710d45511afcb097a143b38098e2b7d12374855eaa7b107cf34f21905
SHA512ad5b68bda307f61d7b035962dddacb01b11281b3fa1202929db88fe514ac4cfb9e0f1bc7cb753356c6e6cb2e73cf051908d4043786728cb10493bbd6815a5c41
-
Filesize
145KB
MD5f3dbda8ce2ce5ab20bb537ed402bc7ad
SHA15d3d2cd0adc00fc0b8327f8734bd7aab10dfbb4d
SHA25683ec5ff710d45511afcb097a143b38098e2b7d12374855eaa7b107cf34f21905
SHA512ad5b68bda307f61d7b035962dddacb01b11281b3fa1202929db88fe514ac4cfb9e0f1bc7cb753356c6e6cb2e73cf051908d4043786728cb10493bbd6815a5c41
-
Filesize
145KB
MD5f3dbda8ce2ce5ab20bb537ed402bc7ad
SHA15d3d2cd0adc00fc0b8327f8734bd7aab10dfbb4d
SHA25683ec5ff710d45511afcb097a143b38098e2b7d12374855eaa7b107cf34f21905
SHA512ad5b68bda307f61d7b035962dddacb01b11281b3fa1202929db88fe514ac4cfb9e0f1bc7cb753356c6e6cb2e73cf051908d4043786728cb10493bbd6815a5c41
-
Filesize
145KB
MD5f3dbda8ce2ce5ab20bb537ed402bc7ad
SHA15d3d2cd0adc00fc0b8327f8734bd7aab10dfbb4d
SHA25683ec5ff710d45511afcb097a143b38098e2b7d12374855eaa7b107cf34f21905
SHA512ad5b68bda307f61d7b035962dddacb01b11281b3fa1202929db88fe514ac4cfb9e0f1bc7cb753356c6e6cb2e73cf051908d4043786728cb10493bbd6815a5c41
-
Filesize
145KB
MD5f3dbda8ce2ce5ab20bb537ed402bc7ad
SHA15d3d2cd0adc00fc0b8327f8734bd7aab10dfbb4d
SHA25683ec5ff710d45511afcb097a143b38098e2b7d12374855eaa7b107cf34f21905
SHA512ad5b68bda307f61d7b035962dddacb01b11281b3fa1202929db88fe514ac4cfb9e0f1bc7cb753356c6e6cb2e73cf051908d4043786728cb10493bbd6815a5c41
-
Filesize
145KB
MD5f3dbda8ce2ce5ab20bb537ed402bc7ad
SHA15d3d2cd0adc00fc0b8327f8734bd7aab10dfbb4d
SHA25683ec5ff710d45511afcb097a143b38098e2b7d12374855eaa7b107cf34f21905
SHA512ad5b68bda307f61d7b035962dddacb01b11281b3fa1202929db88fe514ac4cfb9e0f1bc7cb753356c6e6cb2e73cf051908d4043786728cb10493bbd6815a5c41
-
Filesize
145KB
MD5f3dbda8ce2ce5ab20bb537ed402bc7ad
SHA15d3d2cd0adc00fc0b8327f8734bd7aab10dfbb4d
SHA25683ec5ff710d45511afcb097a143b38098e2b7d12374855eaa7b107cf34f21905
SHA512ad5b68bda307f61d7b035962dddacb01b11281b3fa1202929db88fe514ac4cfb9e0f1bc7cb753356c6e6cb2e73cf051908d4043786728cb10493bbd6815a5c41